LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0022: APT3

APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security.[1][2] This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.[1][3] As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.[4]

EnterpriseG0022GroupObject v1.4Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

APT3 is an ATT&CK intrusion set with multiple aliases and public reporting tying it to campaigns such as Operation Clandestine Fox, Clandestine Wolf, and Double Tap. For leaders, the value of this object is not the name alone: the related ATT&CK context points to a Windows-heavy intrusion pattern involving remote access tooling, credential theft, discovery, lateral movement, scheduled execution, and possible data exfiltration over command-and-control channels. That makes it useful for validating whether core enterprise controls can withstand a capable espionage-style operator rather than only commodity malware.

Executive priority

Use APT3 as a control-readiness and incident-planning scenario: can the organization detect credential access against LSASS, use of RDP/SMB for lateral movement, scheduled task persistence, PowerShell or cmd execution, internal discovery, and outbound exfiltration-like traffic? The external reporting also references historical Flash zero-day/CVE-focused activity, so vulnerability leaders should ensure legacy client-side software exposure and emergency patch processes are measurable. For compliance and board reporting, this group is a good test case for proving endpoint, identity, network, and IR evidence is retained and usable during an investigation.

Technical view

ATT&CK does not provide a group-level detection statement or explicit group platforms, but the relationships are strongly oriented around Windows behaviors and tools: PlugX, SHOTPUT, schtasks, OSInfo, RemoteCMD, LaZagne, LSASS memory access, RDP, SMB/admin shares, scheduled tasks, PowerShell, and Windows command shell. SOC and IR teams should validate detections across the behavior chain: execution through command interpreters, suspicious scheduled task creation or modification, credential access indicators involving LSASS or password recovery tooling, discovery commands for users/processes/network configuration/remote systems, lateral movement over RDP and SMB, and outbound traffic consistent with C2-based exfiltration. Treat aliases such as Gothic Panda, Pirpi, UPS Team, Buckeye, TG-0110, and Threat Group-0110 as intelligence correlation terms, not standalone detection logic.

Likely telemetry

  • Endpoint process creation with command-line arguments, parent/child process context, and script execution details
  • PowerShell logging where available, including script block/module activity and encoded or obfuscated command patterns
  • Windows scheduled task creation, modification, execution, and schtasks.exe usage
  • Windows authentication and logon telemetry for RDP, SMB, administrative shares, and lateral movement paths
  • LSASS access events, credential dumping prevention/alert telemetry, and memory access indicators

Detection direction

  • Prioritize behavior-based analytics over name matching because the group has many aliases and related tools include both custom and publicly available software.
  • Correlate discovery followed by credential access and RDP/SMB activity; each event alone may resemble administration, but the sequence is higher value for detection engineering.
  • Tune scheduled task detections for unusual creators, paths, command interpreters, remote creation, and tasks running from user-writable or unexpected locations.
  • Validate PowerShell and cmd visibility; missing command-line and script telemetry is a major blind spot for the related execution techniques.
  • Review false positives from legitimate administration tools such as schtasks, RDP, SMB, and remote command execution; detections should include user, host role, time, source, and change-ticket context where possible.

Mitigation priorities

  • Reduce credential exposure first: enforce least privilege, protect administrative accounts, restrict credential reuse, and harden systems against LSASS credential theft.
  • Constrain lateral movement paths by limiting RDP and SMB/admin share access to approved administrators, management hosts, and documented business needs.
  • Harden execution surfaces by controlling PowerShell and command-shell abuse, monitoring script execution, and restricting untrusted binaries where feasible.
  • Govern scheduled tasks as a persistence and execution surface: baseline known tasks, alert on unusual creation or modification, and review remote task creation permissions.
  • Maintain endpoint and network visibility sufficient for IR reconstruction, including process, authentication, scheduled task, and egress logs with adequate retention.
Additional notes and limits

The supplied ATT&CK object identifies APT3 as a China-based group that researchers have attributed to China’s Ministry of State Security and lists historical campaigns and aliases. The most actionable defensive context comes from the relationships to software and techniques, especially Windows-oriented tooling and behaviors. This take intentionally treats APT3 as a defensive emulation and readiness scenario rather than asserting current activity or exposure.

No official detection text, group-level tactics, or group-level platforms were supplied. Platform and tactic guidance is inferred only from related ATT&CK techniques and software, not from explicit APT3 object fields. Local telemetry, asset inventory, identity architecture, and approved administrative practices are required to decide what is suspicious in a specific environment.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

APT3

APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security.[1][2] This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.[1][3] As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.[4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

44 rows
DomainIDNameRelationship / procedure
EnterpriseT1053.005Scheduled TaskSub-technique

An APT3 downloader creates persistence by creating the following scheduled task: schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System".[3]

EnterpriseT1104Multi-Stage Channels

An APT3 downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81.[3]

EnterpriseT1110.002Password CrackingSub-technique

APT3 has been known to brute force password hashes to be able to leverage plain text credentials.[5]

EnterpriseT1564.003Hidden WindowSub-technique

APT3 has been known to use -WindowStyle Hidden to conceal PowerShell windows.[3]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

APT3 has used tools to dump passwords from browsers.[4]

EnterpriseT1059.003Windows Command ShellSub-technique

An APT3 downloader uses the Windows command "cmd.exe" /C whoami. The group also uses a tool to execute commands on remote computers.[3][4]

EnterpriseT1016System Network Configuration Discovery

A keylogging tool used by APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.[4][7]

EnterpriseT1049System Network Connections Discovery

APT3 has a tool that can enumerate current network connections.[4][8][7]

EnterpriseT1090.002External ProxySub-technique

An APT3 downloader establishes SOCKS5 connections for its initial C2.[3]

EnterpriseT1218.011Rundll32Sub-technique

APT3 has a tool that can run DLLs.[8]

EnterpriseT1027Obfuscated Files or Information

APT3 obfuscates files or information to help evade defensive measures.[4]

EnterpriseT1566.002Spearphishing LinkSub-technique

APT3 has sent spearphishing emails containing malicious links.[1]

EnterpriseT1098.007Additional Local or Domain GroupsSub-technique

APT3 has been known to add created accounts to local admin groups to maintain elevated access.[9]

EnterpriseT1204.001Malicious LinkSub-technique

APT3 has lured victims into clicking malicious links delivered through spearphishing.[1]

EnterpriseT1041Exfiltration Over C2 Channel

APT3 has a tool that exfiltrates data over the C2 channel.[8]

EnterpriseT1552.001Credentials In FilesSub-technique

APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.[4]

EnterpriseT1074.001Local Data StagingSub-technique

APT3 has been known to stage files for exfiltration in a single location.[9]

EnterpriseT1078.002Domain AccountsSub-technique

APT3 leverages valid accounts after gaining credentials for use within the victim domain.[4]

EnterpriseT1005Data from Local System

APT3 will identify Microsoft Office documents on the victim's computer.[9]

EnterpriseT1203Exploitation for Client Execution

APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.[1][8]

EnterpriseT1021.002SMB/Windows Admin SharesSub-technique

APT3 will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement.[4]

EnterpriseT1574.001DLLSub-technique

APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.[8][6]

EnterpriseT1087.001Local AccountSub-technique

APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.[4]

EnterpriseT1070.004File DeletionSub-technique

APT3 has a tool that can delete files.[8]

EnterpriseT1083File and Directory Discovery

APT3 has a tool that looks for files and directories on the local file system.[8][7]

EnterpriseT1546.008Accessibility FeaturesSub-technique

APT3 replaces the Sticky Keys binary C:\Windows\System32\sethc.exe for persistence.[9]

EnterpriseT1560.001Archive via UtilitySub-technique

APT3 has used tools to compress data before exfilling it.[9]

EnterpriseT1082System Information Discovery

APT3 has a tool that can obtain information about the local system.[4][7]

EnterpriseT1059.001PowerShellSub-technique

APT3 has used PowerShell on victim systems to download and run payloads after exploitation.[3]

EnterpriseT1543.003Windows ServiceSub-technique

APT3 has a tool that creates a new service for persistence.[3]

EnterpriseT1003.001LSASS MemorySub-technique

APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument "dig."[4]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

APT3 places scripts in the startup folder for persistence.[3]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

APT3 enables the Remote Desktop Protocol for persistence.[9] APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.[10]

EnterpriseT1057Process Discovery

APT3 has a tool that can list out currently running processes.[8][7]

EnterpriseT1095Non-Application Layer Protocol

An APT3 downloader establishes SOCKS5 connections for its initial C2.[3]

EnterpriseT1069Permission Groups Discovery

APT3 has a tool that can enumerate the permissions associated with Windows groups.[4]

EnterpriseT1018Remote System Discovery

APT3 has a tool that can detect the existence of remote systems.[4][8]

EnterpriseT1056.001KeyloggingSub-technique

APT3 has used a keylogging tool that records keystrokes in encrypted files.[4]

EnterpriseT1036.010Masquerade Account NameSub-technique

APT3 has been known to create or enable accounts, such as support_388945a0.[9]

EnterpriseT1027.002Software PackingSub-technique

APT3 has been known to pack their tools.[5][1]

EnterpriseT1136.001Local AccountSub-technique

APT3 has been known to create or enable accounts, such as support_388945a0.[9]

EnterpriseT1105Ingress Tool Transfer

APT3 has a tool that can copy files to remote machines.[8]

EnterpriseT1033System Owner/User Discovery

An APT3 downloader uses the Windows command "cmd.exe" /C whoami to verify that it is running with the elevated privileges of “System.”[3]

EnterpriseT1027.005Indicator Removal from ToolsSub-technique

APT3 has been known to remove indicators of compromise from tools.[5]

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0111: schtasks

schtasks is used to schedule execution of programs or scripts on a Windows system to run at a specific date and time. [1]

Windows
ToolEnterprise

S0349: LaZagne

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. LaZagne is publicly available on GitHub.[1]

LinuxmacOSWindows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1104: Multi-Stage ChannelsEnterpriseuses · TechniqueT1110.002: Password CrackingEnterpriseuses · MalwareS0165: OSInfoEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · ToolS0111: schtasksEnterpriseuses · MalwareS0013: PlugXEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1090.002: External ProxyEnterpriseuses · TechniqueT1218.011: Rundll32Enterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · ToolS0349: LaZagneEnterpriseuses · TechniqueT1098.007: Additional Local or Domain GroupsEnterpriseuses · TechniqueT1204.001: Malicious LinkEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1552.001: Credentials In FilesEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1078.002: Domain AccountsEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1203: Exploitation for Client ExecutionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.4
Created
Modified
Raw hash
ec7ee360150a2df1...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.4Current bundleec7ee360150a…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye Clandestine Wolf

    Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.

    Open source URL
  2. [2]
    Recorded Future APT3 May 2017

    Insikt Group (Recorded Future). (2017, May 17). Recorded Future Research Concludes Chinese Ministry of State Security Behind APT3. Retrieved September 16, 2024.

    Open source URL
  3. [3]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  4. [4]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  5. [5]
    APT3 Adversary Emulation Plan

    Korban, C, et al. (2017, September). APT3 Adversary Emulation Plan. Retrieved January 16, 2018.

    Open source URL
  6. [6]
    FireEye Clandestine Fox Part 2

    Scott, M.. (2014, June 10). Clandestine Fox, Part Deux. Retrieved January 14, 2016.

    Open source URL
  7. [7]
    evolution of pirpi

    Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.

    Open source URL
  8. [8]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  9. [9]
    aptsim

    valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.

  10. [10]
    Twitter Cglyer Status Update APT3 eml

    Glyer, C. (2018, April 14). @cglyer Status Update. Retrieved September 12, 2024.

    Open source URL
  11. [11]
    APT3

    (Citation: FireEye Clandestine Wolf) (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  12. [12]
    APT3

    (Citation: FireEye Clandestine Wolf) (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  13. [13]
    APT3

    (Citation: FireEye Clandestine Wolf) (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  14. [14]
    Buckeye

    (Citation: Symantec Buckeye)

  15. [15]
    Buckeye

    (Citation: Symantec Buckeye)

  16. [16]
    Buckeye

    (Citation: Symantec Buckeye)

  17. [17]
    FireEye Clandestine Wolf

    Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.

    Open source URL
  18. [18]
    FireEye Clandestine Wolf

    Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.

    Open source URL
  19. [19]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  20. [20]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  21. [21]
    Gothic Panda

    (Citation: PWC Pirpi Scanbox) (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  22. [22]
    Gothic Panda

    (Citation: PWC Pirpi Scanbox) (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  23. [23]
    Gothic Panda

    (Citation: PWC Pirpi Scanbox) (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  24. [24]
    PWC Pirpi Scanbox

    Lancaster, T. (2015, July 25). A tale of Pirpi, Scanbox & CVE-2015-3113. Retrieved March 30, 2016.

  25. [25]
    PWC Pirpi Scanbox

    Lancaster, T. (2015, July 25). A tale of Pirpi, Scanbox & CVE-2015-3113. Retrieved March 30, 2016.

  26. [26]
    PWC Pirpi Scanbox

    Lancaster, T. (2015, July 25). A tale of Pirpi, Scanbox & CVE-2015-3113. Retrieved March 30, 2016.

  27. [27]
    Pirpi

    (Citation: PWC Pirpi Scanbox)

  28. [28]
    Pirpi

    (Citation: PWC Pirpi Scanbox)

  29. [29]
    Pirpi

    (Citation: PWC Pirpi Scanbox)

  30. [30]
    Recorded Future APT3 May 2017

    Insikt Group (Recorded Future). (2017, May 17). Recorded Future Research Concludes Chinese Ministry of State Security Behind APT3. Retrieved September 16, 2024.

    Open source URL
  31. [31]
    Recorded Future APT3 May 2017

    Insikt Group (Recorded Future). (2017, May 17). Recorded Future Research Concludes Chinese Ministry of State Security Behind APT3. Retrieved September 16, 2024.

    Open source URL
  32. [32]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  33. [33]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  34. [34]
    TG-0110

    (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  35. [35]
    TG-0110

    (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  36. [36]
    TG-0110

    (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  37. [37]
    Threat Group-0110

    (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  38. [38]
    Threat Group-0110

    (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  39. [39]
    Threat Group-0110

    (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  40. [40]
    UPS Team

    (Citation: FireEye Clandestine Wolf) (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  41. [41]
    UPS Team

    (Citation: FireEye Clandestine Wolf) (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  42. [42]
    UPS Team

    (Citation: FireEye Clandestine Wolf) (Citation: Recorded Future APT3 May 2017) (Citation: Symantec Buckeye)

  43. [43]
    mitre-attackG0022
    Open source URL
  44. [44]
    mitre-attackG0022
    Open source URL
  45. [45]
    mitre-attackG0022
    Open source URL
  46. [46]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  47. [47]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  48. [48]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  49. [49]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  50. [50]
    APT3 Adversary Emulation Plan

    Korban, C, et al. (2017, September). APT3 Adversary Emulation Plan. Retrieved January 16, 2018.

    Open source URL
  51. [51]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  52. [52]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  53. [53]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  54. [54]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  55. [55]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  56. [56]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  57. [57]
    FireEye Clandestine Fox Part 2

    Scott, M.. (2014, June 10). Clandestine Fox, Part Deux. Retrieved January 14, 2016.

    Open source URL
  58. [58]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  59. [59]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  60. [60]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  61. [61]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  62. [62]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  63. [63]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  64. [64]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  65. [65]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  66. [66]
    evolution of pirpi

    Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.

    Open source URL
  67. [67]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  68. [68]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  69. [69]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  70. [70]
    evolution of pirpi

    Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.

    Open source URL
  71. [71]
    evolution of pirpi

    Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.

    Open source URL
  72. [72]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  73. [73]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  74. [74]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  75. [75]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  76. [76]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  77. [77]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  78. [78]
    FireEye Clandestine Wolf

    Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.

    Open source URL
  79. [79]
    FireEye Clandestine Wolf

    Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.

    Open source URL
  80. [80]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  81. [81]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  82. [82]
    aptsim

    valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.

  83. [83]
    FireEye Clandestine Wolf

    Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.

    Open source URL
  84. [84]
    FireEye Clandestine Wolf

    Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.

    Open source URL
  85. [85]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  86. [86]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  87. [87]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  88. [88]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  89. [89]
    aptsim

    valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.

  90. [90]
    aptsim

    valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.

  91. [91]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  92. [92]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  93. [93]
    aptsim

    valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.

  94. [94]
    aptsim

    valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.

  95. [95]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  96. [96]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  97. [97]
    FireEye Clandestine Wolf

    Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.

    Open source URL
  98. [98]
    FireEye Clandestine Wolf

    Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.

    Open source URL
  99. [99]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  100. [100]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  101. [101]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  102. [102]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  103. [103]
    FireEye Clandestine Fox Part 2

    Scott, M.. (2014, June 10). Clandestine Fox, Part Deux. Retrieved January 14, 2016.

    Open source URL
  104. [104]
    FireEye Clandestine Fox Part 2

    Scott, M.. (2014, June 10). Clandestine Fox, Part Deux. Retrieved January 14, 2016.

    Open source URL
  105. [105]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  106. [106]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  107. [107]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  108. [108]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  109. [109]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  110. [110]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  111. [111]
    evolution of pirpi

    Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.

    Open source URL
  112. [112]
    evolution of pirpi

    Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.

    Open source URL
  113. [113]
    aptsim

    valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.

  114. [114]
    aptsim

    valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.

  115. [115]
    aptsim

    valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.

  116. [116]
    aptsim

    valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.

  117. [117]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  118. [118]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  119. [119]
    evolution of pirpi

    Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.

    Open source URL
  120. [120]
    evolution of pirpi

    Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.

    Open source URL
  121. [121]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  122. [122]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  123. [123]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  124. [124]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  125. [125]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  126. [126]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  127. [127]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  128. [128]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  129. [129]
    Twitter Cglyer Status Update APT3 eml

    Glyer, C. (2018, April 14). @cglyer Status Update. Retrieved September 12, 2024.

    Open source URL
  130. [130]
    aptsim

    valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.

  131. [131]
    aptsim

    valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.

  132. [132]
    FireEye Clandestine Wolf

    Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.

    Open source URL
  133. [133]
    FireEye Clandestine Wolf

    Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.

    Open source URL
  134. [134]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  135. [135]
    evolution of pirpi

    Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.

    Open source URL
  136. [136]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  137. [137]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  138. [138]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  139. [139]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  140. [140]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  141. [141]
    aptsim

    valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.

  142. [142]
    APT3 Adversary Emulation Plan

    Korban, C, et al. (2017, September). APT3 Adversary Emulation Plan. Retrieved January 16, 2018.

    Open source URL
  143. [143]
    FireEye Clandestine Wolf

    Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016.

    Open source URL
  144. [144]
    aptsim

    valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017.

  145. [145]
    Symantec Buckeye

    Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.

    Open source URL
  146. [146]
    FireEye Clandestine Fox

    Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.

    Open source URL
  147. [147]
    FireEye Operation Double Tap

    Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.

    Open source URL
  148. [148]
    APT3 Adversary Emulation Plan

    Korban, C, et al. (2017, September). APT3 Adversary Emulation Plan. Retrieved January 16, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use